fix: upgrade handlebars to 4.7.9 (CVE-2026-33937) - #1873

Open

anupamme wants to merge 691 commits into

nodeSolidServer:devfrom

anupamme:fix-repo-node-solid-server-cve-2026-33937-handlebars

This pull request is big! We're only showing the most recent 250 commits

Commits on Mar 18, 2024

Merge pull request #1777 from nodeSolidServer/fix/issue#1774
bourgeoa
authored
f5652f3

Commits on Mar 21, 2024

shaky fix for issue#1692
zg009
committed
e949377
removed resource from originally failing tests
zg009
committed
4d029be
Update lib/handlers/put.js
zg009
and
TallTed
authored
d5a6103
Update lib/handlers/put.js
zg009
and
TallTed
authored
1a8987e
Update lib/handlers/put.js
zg009
and
TallTed
authored
08886af
moved invalid suffix logic to LDP class, write test for patch in patch-test and put in http-test, cleaned up package.json
zg009
committed
52480a3
force resolve
zg009
committed
4becb86

Commits on Mar 22, 2024

added invalid suffix check to ldp and test in http-test
zg009
committed
51163e9

Commits on Mar 23, 2024

only for containers
bourgeoa
committed
d56cdf0

Commits on Mar 25, 2024

fixed todo and added .meta test in patch-test
zg009
committed
e4bb2e9

Commits on Mar 29, 2024

Commits on Apr 1, 2024

Update lib/ldp.js
zg009
and
TallTed
authored
f6ef443
Update lib/ldp.js
zg009
and
TallTed
authored
141868d
Update test/integration/http-test.js
zg009
and
TallTed
authored
be1429e
Update test/integration/http-test.js
zg009
and
TallTed
authored
47a66d6
Update test/integration/http-test.js
zg009
and
TallTed
authored
d9a6865
Update test/integration/http-test.js
zg009
and
TallTed
authored
81d8dfd

Commits on Apr 3, 2024

Merge pull request #1778 from nodeSolidServer/fix/issue#1692
bourgeoa
authored
0b6df62
mashlib@1.8.10
bourgeoa
committed
f97d7db
5.7.10
bourgeoa
committed
21096e2

Commits on Apr 20, 2024

describe AccountManager (OIDC account creation tests) working with node v15
zg009
committed
86784bd
describe Singue User Signup page working with node v15
zg009
committed
6fd2354
account-creation-oidc-test passing all with node 15
zg009
committed
8590a8f
account template test has weird expectation, not sure how related?
zg009
committed
ab4dc83
acl-oidc-test appears to be passing, should 4 test cases that are skipped pass as well?
zg009
committed
2971101
authentication-oidc-test appears to be passing on node v 15
zg009
committed
9781e02
header-test commented out code works node v15
zg009
committed
2a6ea44
fixing ldp tests
zg009
committed
0c1dce0
fixing ldp tests more
zg009
committed
81577bf
fixed more ldp tests
zg009
committed
2fbb0b1
fixed graph tests
zg009
committed
aaa82b8
putGraph and getGraph work in ldp-test
zg009
committed
cbaae77
delete passing in ldp-test
zg009
committed
73456f3
ldp-test mostly working, need way to test listContainer and overQuota
zg009
committed
0d59524
all but listContainer working in ldp-test
zg009
committed
5a60c6f

Commits on Apr 21, 2024

remove debug console.log statements
zg009
committed
cdc052d
ldp tests all passing
zg009
committed
e589850
all FIX1502 addressed
zg009
committed
49e8e81
4 tests in LDP Skipped - do not evaluate properly, conditionals also do not exist in code anymore?
zg009
committed
d173bca
added cleanup for account manager test, need two tests to be fixed
zg009
committed
0806b7f
fixed broken account manager tests, added files for support
zg009
committed
f3e34c1

Commits on Apr 22, 2024

Merge pull request #1763 from ewingson/main
bourgeoa
authored
60ef3aa

Commits on Apr 30, 2024

Merge pull request #1782 from nodeSolidServer/fix/issue#1502
bourgeoa
authored
bb1e52b
mashlib@1.8.11
bourgeoa
committed
f69653b
5.7.11
bourgeoa
committed
07ee53c

Commits on May 11, 2024

Commits on May 13, 2024

minor cleaning and variable clarity
zg009
committed
72b20b4
renamed example var
zg009
committed
18b7cb3

Commits on May 17, 2024

check against externalWebId
bourgeoa
committed
1034123

Commits on May 21, 2024

webId relative to pod
bourgeoa
committed
99b3219
removed hostname registration deleted fn
zg009
committed
a5ab656
added function to also strip port, updated test cases
zg009
committed
3f2eb27

Commits on May 22, 2024

use webUri.origin and update tests
bourgeoa
committed
6a44656

Commits on May 24, 2024

Update put.js send 200 or 201 depending on prexistance of resource
jeff-zucker
authored
5e71231
Update put.js
jeff-zucker
authored
d602ad8

Commits on May 25, 2024

Update put.js 200->204 when replacing
jeff-zucker
authored
12d3405

Commits on May 29, 2024

Update lib/handlers/put.js
CxRes
and
bourgeoa
authored
df9beab

Commits on May 30, 2024

tests and cleaning
bourgeoa
committed
43bf813

Commits on May 31, 2024

Commits on Jun 2, 2024

replace res.sendStatus with res.status and update tests
bourgeoa
committed
a69da13
Use Double Quotes in package.json > scripts
CxRes
authored
b8e9aed

Commits on Jun 15, 2024

Merge pull request #1787 from nodeSolidServer/CxRes-patch-lint-script-quotes
bourgeoa
authored
843c771

Commits on Aug 28, 2024

Merge pull request #1786 from nodeSolidServer/CxRes-patch-set-status-code
jeff-zucker
authored
f5b2b5c

Commits on Aug 30, 2024

feat: PREP Notifications
CxRes
committed
21b15be
feat: Add Solid-PREP Notifications
CxRes
committed
f4fb5a0
Bump CI and Docker to node v22
CxRes
committed
109ce09
Replace nyc with c8
CxRes
committed
7b23e57

Commits on Sep 8, 2024

fix: Correct Parenting for Solid-PREP Notifications
CxRes
committed
3d93e13
Step Down to Node 20
CxRes
committed
fd99081
fix: Relax Content-Type Checks in Integration Tests
CxRes
committed
8021633

Commits on Sep 9, 2024

fix: Repository for Surface Tests
CxRes
committed
e0ebc31

Commits on Oct 8, 2024

chore: Bump Express PREP
CxRes
committed
beaaa03
feat: Add Tests for PREP
CxRes
committed
bda034a

Commits on Oct 10, 2024

feat: Add Flag to disable PREP
CxRes
committed
b0e7eb0

Commits on Oct 13, 2024

refactor: Remove Commented Code in `get.js`
CxRes
committed
6a287e4

Commits on Oct 19, 2024

chore: Bump PREP Dependencies
CxRes
committed
a6067e3

Commits on Oct 23, 2024

fix: Send Parent Notifications on Root
CxRes
committed
568b58a
fix: Activity is `as:Add` on Container POST
CxRes
committed
3fa2be9
fix: Set `target` on Container POST
CxRes
committed
6f4b22b
fix: Set `origin` when Contained Resource is Removed
CxRes
committed
2a277ff
test: Notification when Creating a Container with POST
CxRes
committed
d08a88f
chore: Bump Express PREP
CxRes
committed
33997ae
fix: Do Not Overwrite `req.url` on Container PUT
CxRes
committed
1f6c16f
test: Notification when Creating/Deleting Container in Container
CxRes
committed
c933a74
refactor: Add Debugging for Failed Notifications
CxRes
committed
2da77b0

Commits on Oct 24, 2024

fix: Correctly Set Location on non-RDF Notifications
CxRes
committed
44dc0bc

Commits on Nov 4, 2024

rewrite create container to keep req
bourgeoa
committed
29f3e08
Merge pull request #1797 from nodeSolidServer/basic-prep
bourgeoa
authored
fd5837c
Update README.md
bourgeoa
authored
671586c

Commits on Nov 5, 2024

5.8.0
bourgeoa
committed
953785d
Update test_image_foundations.py
bourgeoa
authored
a8bf8c4
Merge branch 'resourceMapper' of https://github.com/solid/node-solid-server into main
bourgeoa
committed
417bf13
package-lock.json
bourgeoa
committed
1b1989e
Merge branch 'main' into fix#1783
bourgeoa
committed
cb804ab
Merge pull request #1784 from nodeSolidServer/fix#1783
bourgeoa
authored
fa7e7e5

Commits on Nov 6, 2024

5.8.1
bourgeoa
committed
a3ab58e
Merge branch 'main' of https://github.com/solid/node-solid-server into main
bourgeoa
committed
4ce0c0e
5.8.2
bourgeoa
committed
41a2ba3

Commits on Nov 8, 2024

fix: Use XML Date Format in Notifications
CxRes
committed
fef1ea2
fix: Swapped `object` and `target`/`origin` in Notifications
CxRes
committed
ad7073b

Commits on Nov 10, 2024

fix: Notification Templates
CxRes
committed
c33bc32
feat/refactor: Event-ID Generated for Notifications Only
CxRes
committed
6c31436
chore: Ensure CI runs Node 20
CxRes
committed
d6a992f

Commits on Nov 11, 2024

fix: Wrap IRIs in <> in Turtle Notification Templete
CxRes
and
csarven
authored
d86d150

Commits on Nov 23, 2024

Merge pull request #1801 from nodeSolidServer/basic-prep-fix-1
bourgeoa
authored
96ce2f0
mashlib@1.10.2
bourgeoa
committed
108f5fe
5.8.3
bourgeoa
committed
86748d8

Commits on Nov 26, 2024

replace deprecated defaultForNew
bourgeoa
committed
4a2d5ba

Commits on Jan 13, 2025

Merge pull request #1804 from nodeSolidServer/fix-templates
bourgeoa
authored
5dc908c

Commits on Feb 11, 2025

replace res.set()
bourgeoa
committed
0ce11b1

Commits on Feb 12, 2025

add res.statusCode for prep
bourgeoa
committed
edd5a52
Clean up status code
CxRes
authored
887a94e
Merge pull request #1808 from nodeSolidServer/fix/issue#1807
bourgeoa
authored
67fc385
5.8.4
bourgeoa
committed
87740a8

Commits on Feb 14, 2025

res.set(headers) and mashlib@1.10.4
bourgeoa
committed
552b7c4

Commits on Feb 21, 2025

mashlib text/markdown
bourgeoa
committed
9b6a44c
remove comment
bourgeoa
committed
cb17bac
update minor dependencuies
bourgeoa
committed
2b5d78b
Merge pull request #1809 from nodeSolidServer/fix/issue#1807
bourgeoa
authored
d32d45f
5.8.5
bourgeoa
committed
19ba5e5

Commits on Apr 9, 2025

remove --experimental-require-module
bourgeoa
committed
471c99e
c8 -n
bourgeoa
committed
6b667bf
mocha -n
bourgeoa
committed
3011c50
-n experimental-require-module
bourgeoa
committed
5ceab36
Update ci.yml
bourgeoa
authored
8e3f3c3
Merge branch 'fix/issue#1798' of https://github.com/solid/node-solid-server into fix/issue#1798
bourgeoa
committed
82b0ffb
skip single-user
bourgeoa
committed
1fe3a95
nyc to replace c8
bourgeoa
committed
ba5c8eb

Commits on Apr 10, 2025

remove test/integration
bourgeoa
committed
0431dcf

Commits on Apr 11, 2025

rm account-creation-oidc-test.js
bourgeoa
committed
eb8d1e8

Commits on Apr 12, 2025

rm('resources/accounts/single-user/')
bourgeoa
committed
78f574b
resolve
bourgeoa
committed
ca769c6
remove test single-user
bourgeoa
committed
f66a8ea

Commits on Apr 14, 2025

restore test account-creation-oidc-test.js
bourgeoa
committed
7fa1039

Commits on Apr 17, 2025

run test/unit first
bourgeoa
committed
3c2ce8a
rename to www
bourgeoa
committed
eaeba0a
Merge pull request #1813 from nodeSolidServer/fix/issue#1798
bourgeoa
authored
1fcedb2

Commits on Oct 29, 2025

update mashlib@1.11.1
bourgeoa
committed
8ed4e77

Commits on Oct 31, 2025

npm upgrade jwa see issue 1823
bourgeoa
committed
3f5adfa

Commits on Nov 1, 2025

Merge pull request #1828 from nodeSolidServer/jwa
bourgeoa
authored
e88c20d
5.8.6
bourgeoa
committed
f029cba

Commits on Nov 3, 2025

replace deprecated request critical issue
bourgeoa
committed
9b0a3f4
use basic-request in tests
bourgeoa
committed
4ddec6b

Commits on Nov 4, 2025

edit .git
bourgeoa
committed
b3333e5
Merge pull request #1829 from nodeSolidServer/fix/request
bourgeoa
authored
2a100f4

Commits on Nov 6, 2025

replace npm request in tests
bourgeoa
committed
9f12bba

Commits on Nov 7, 2025

high security audit fixes
bourgeoa
committed
d75a7cd
add rdflib
bourgeoa
committed
35b4ff0
Merge pull request #1831 from nodeSolidServer/fix/request
bourgeoa
authored
b3b3de3
5.8.7
bourgeoa
committed
8f26c81
missing common/css/bootstrap.min.css
bourgeoa
committed
b60acb1
5.8.8
bourgeoa
committed
11b8d9d

Commits on Nov 13, 2025

mixed ESM
bourgeoa
committed
6f6e708
more mixed for app
bourgeoa
committed
6e0b966
more mixed for app and test
bourgeoa
committed
78c0558
index.mjs
bourgeoa
committed
f3f3968
Fix line endings in bin/solid for Docker compatibility
CI Fix
committed
d5d0e75
package.json
CI Fix
committed
13e5054
.gitattributes
CI Fix
committed
0357fea
test/ migrated to esm in test-esm/
CI Fix
committed
5b65f43
ESM Migration: Convert main lib files and lib/api to ESM
CI Fix
committed
ac4eec7
ESM Migration: Complete lib/api/ and lib/handlers/ conversion
CI Fix
committed
73b2626

Commits on Nov 14, 2025

Add ESM test command to CI workflow
bourgeoa
authored
277633e

Commits on Nov 20, 2025

add missing test-esm/resources
CI Fix
committed
562a91b
update esm and tests
CI Fix
committed
d2ebe52

Commits on Nov 22, 2025

add missing .mjs files
CI Fix
committed
86da28f

Commits on Nov 25, 2025

missing mjs file
CI Fix
committed
04fef95
add esm entry point
CI Fix
committed
f3d0a1b
missing content in ldp.mjs
CI Fix
committed
60e2f93
miscellaneous updates
CI Fix
committed
53c8278
updates lib/api
CI Fix
committed
635f7b2
updates to lib/srvices
CI Fix
committed
ebf457f
updates to lib/models
CI Fix
committed
7bd6cdd
updates to lib/payment-pointer-discovery.mjs
CI Fix
committed
aba64d9
updates to lib/ldp-container.mjs
CI Fix
committed
b935bdf
updates to lib/requests/auth-request.mjs
CI Fix
committed
3f536ab
updates to lib/rdf-notification-template.mjs
CI Fix
committed
beb6dad
updates to lib/handlers
CI Fix
committed
c668ad3
lib/server-config.mjs
CI Fix
committed
5c258b2

Commits on Nov 30, 2025

updates .mjs
CI Fix
committed
b370ff7
Revert "updates .mjs"
CI Fix
committed
1bf6b36
fix critical node-forge
CI Fix
committed
fd1a323
fix critical issue on node-forge
CI Fix
committed
7828cb6

Commits on Dec 1, 2025

esm account-manager and test
CI Fix
committed
f8ff940

Commits on Dec 2, 2025

add default-templates/emails .mjs
CI Fix
committed
1706ce9
update unit test to esm
CI Fix
committed
ec340b2
return to CJS utils.js
CI Fix
committed
32e473c

Commits on Dec 6, 2025

update to esm only
CI Fix
committed
7afef98
lint issues
CI Fix
committed
21798f6
add nyc-esm
CI Fix
committed
128fc7c
some cleaning
CI Fix
committed
be487db

Commits on Dec 8, 2025

standard lint issues
CI Fix
committed
89395b3
Merge branch 'main' into nss2esm-hybrid
bourgeoa
authored
924d4b8

Commits on Dec 21, 2025

update require() and debug's
bourgeoa
committed
1e3025d
delete patch.mjs.old
bourgeoa
committed
3f1fba3

Commits on Dec 22, 2025

updates
bourgeoa
committed
6db0f28
resources/config
bourgeoa
committed
7610c97

Commits on Dec 23, 2025

rename test-esm to test
bourgeoa
committed
23f2403
standard issues
bourgeoa
committed
94454d1
remove test-esm from workflow
bourgeoa
committed
951d712
rm *.js to keep *.mjs
bourgeoa
committed
9424280
update bin/solid and import index.mjs
bourgeoa
committed
e1b12bb
c8 in CI workflow
bourgeoa
committed
3544e9b
add missing test files
bourgeoa
committed
40da84a
some cleaning
bourgeoa
committed
c65a248

Commits on Dec 24, 2025

mashlib was not loading and server OIDC listening issue
bourgeoa
committed
bb700b5
npm publish
bourgeoa
committed
f1cbcc9

Commits on Dec 27, 2025

oidc to include ES256/384/512
bourgeoa
committed
9436591
update patch tests to rdflib@2.3.2
bourgeoa
committed
954a10d

Commits on Jan 2, 2026

update to rfc9702, eslint@9
bourgeoa
committed
0d93949
eslint.config.mjs
bourgeoa
committed
bb4f708
Merge pull request #1835 from nodeSolidServer/esm2
bourgeoa
authored
9b10841
fix critical
bourgeoa
committed
5598850
Merge pull request #1836 from nodeSolidServer/esm2
bourgeoa
authored
6f51539
replace node-fetch with fetch native
bourgeoa
committed
0ca48fc
update minor
bourgeoa
committed
6889633
update mime-types
bourgeoa
committed
d8831d9
whatwg-url
bourgeoa
committed
423774e
supertest
bourgeoa
committed
183f113
mocha
bourgeoa
committed
d6dc935
fs-extra
bourgeoa
committed
b3f295e
@fastify/busboy
bourgeoa
committed
91f9520
glob
bourgeoa
committed
96553e5
is-ip
bourgeoa
committed
48b9d35
cross-env
bourgeoa
committed
eaab15a
into-stream
bourgeoa
committed
809f996
commander
bourgeoa
committed
957b66e

Commits on Jan 6, 2026

update to mashlib>=2.0.0
bourgeoa
committed
27cfb89

Commits on Jan 7, 2026

remove some defaults .js
bourgeoa
committed
afc4929
update minor dependencies
bourgeoa
committed
f9f9ef1
6.0.0
bourgeoa
committed
1876c4b
V6.0.0
bourgeoa
authored
e470e61
Update CHANGELOG for version 6.0.0
bourgeoa
authored
fd8426c

Commits on Jan 11, 2026

Add upgrade notes for version <6.0.0
bourgeoa
authored
2caddca

Commits on Jul 28, 2026

Remove unused resource parameter from getPermissionsFor
NaderMohamed325
committed
2ba5a9b
Potential fix for pull request finding
NaderMohamed325
and
Copilot
authored
9930190

Commits on Aug 8, 2026

Merge pull request #1870 from NaderMohamed325/fix/remove-unused-resource-param
bourgeoa
authored
bf77c4b
mashlib@2.2.2
bourgeoa
committed
af81129
replaced the stale TabulatorOutline marker with runDataBrowser
bourgeoa
committed
1c4ccaa
Merge pull request #1872 from nodeSolidServer/fix/remove-unused-resource-param
bourgeoa
authored
e0ee057
fix: CVE-2026-33937 security vulnerability
anupamme
committed
8f511a1